@hachej/boring-agent 0.1.89 → 0.1.91

package/dist/server/index.js

@@ -1,6 +1,10 @@
 import {
   AgentDirectoryCompilerError,
-  FileHandleStore,
+  AgentFleetCompilationError,
+  AgentFleetCompilationErrorCode,
+  AuthoredAgentMaterializationError,
+  EmbeddedAgentGateway,
+  InMemoryAgentRequestLedger,
   MANAGED_AGENT_MCP_DELIVERY_RULE,
   MANAGED_AGENT_MCP_ORIGIN_SURFACE,
   ManagedAgentMcpDelegateController,
@@ -10,73 +14,75 @@ import {
   RemoteWorkerClient,
   RemoteWorkerClientError,
   UV_SETUP_COMMANDS,
-  VERCEL_PROVISIONING_CACHE_ROOT,
-  VERCEL_SANDBOX_WORKSPACE_ROOT,
   WORKER_INTERNAL_TOKEN_HEADER,
   WORKER_REQUEST_ID_HEADER,
   WORKER_WORKSPACE_ID_HEADER,
   applyCspHeaders,
-  assertRealPathWithinWorkspace,
   autoDetectMode,
-  bakeSnapshotIfNeeded,
   buildDeploymentSnapshotRecipe,
-  buildPackageHash,
-  buildSnapshotRecipeHash,
   compileAgentDirectory,
   constantTimeTokenEqual,
   createAgent,
   createAgentApp,
-  createBwrapSandbox,
-  createDirectSandbox,
+  createAgentHost,
+  createAgentHostLegacyRoutePolicy,
+  createAuthMiddleware,
+  createDirectModeAdapter,
+  createEnvironmentProvisioningFingerprint,
+  createFakeAuthorityVerifierV1,
+  createHostSideCredentialResolverV1,
+  createInMemoryCredentialBackendV1,
+  createLocalModeAdapter,
   createManagedAgentMcpDelegateController,
   createManagedAgentMcpHttpHandler,
   createManagedAgentMcpServer,
-  createNodeWorkspace,
+  createProviderRuntimeModeAdapter,
   createRemoteWorkerModeAdapter,
   createRemoteWorkerSandbox,
   createRemoteWorkerWorkspace,
   createResolvedAgentDigest,
-  createVercelDeploymentSnapshotProvider,
-  createVercelProvisioningAdapter,
-  createVercelSandboxWorkspace,
+  createResolvedRuntimeScopeIdentity,
+  createSandboxRuntimeModeAdapter,
+  createValidatingAgentFleetCompiler,
+  createVercelSandboxModeAdapter,
   decodeBytesFromWorker,
   encodeBytesForWorker,
-  fileRoutes,
-  getBoringAgentPathEntries,
-  getBoringAgentRuntimeEnv,
-  getBoringAgentRuntimePaths,
   hasBwrap,
+  materializeAgentDirectory,
   normalizeMeteringUsage,
   prepareDeploymentSnapshot,
-  prepareVercelDeploymentSnapshot,
   provisionRuntimeWorkspace,
   provisionWorkspaceRuntime,
   registerAgentRoutes,
   registerShareEntryResources,
   resolveAgentDeployment,
+  resolveBuiltinRuntimeLayoutRoot,
   resolveMode,
-  resolveSandboxHandle,
   resolveWorkspaceRoot,
+  sandboxRuntimeHostOperations,
   shareResourceUri,
-  validatePath
-} from "../chunk-I7UEASPG.js";
-import "../chunk-XPQEF32D.js";
-import "../chunk-M32FXCIN.js";
-import "../chunk-WSQ5QNIY.js";
-import "../chunk-BDYXKHWY.js";
+  withResolvedCredential
+} from "../chunk-BHH5NH7P.js";
 import {
   PI_PACKAGE_RESOURCE_FILTERS,
   compactPiPackages,
-  createLogger,
   createResourceSettingsManager,
   mergePiPackageSources,
   piPackageSourceKey
-} from "../chunk-WZCTVT57.js";
+} from "../chunk-IWBC6SF7.js";
+import "../chunk-CJ2BW2W2.js";
+import "../chunk-NITBKFG6.js";
 import "../chunk-AQBXNPMD.js";
-import "../chunk-GOM3VJOJ.js";
+import "../chunk-WSQ5QNIY.js";
+import "../chunk-PZC76CIA.js";
+import "../chunk-2GBHYJVC.js";
 export {
   AgentDirectoryCompilerError,
-  FileHandleStore,
+  AgentFleetCompilationError,
+  AgentFleetCompilationErrorCode,
+  AuthoredAgentMaterializationError,
+  EmbeddedAgentGateway,
+  InMemoryAgentRequestLedger,
   MANAGED_AGENT_MCP_DELIVERY_RULE,
   MANAGED_AGENT_MCP_ORIGIN_SURFACE,
   ManagedAgentMcpDelegateController,
@@ -87,59 +93,56 @@ export {
   RemoteWorkerClient,
   RemoteWorkerClientError,
   UV_SETUP_COMMANDS,
-  VERCEL_PROVISIONING_CACHE_ROOT,
-  VERCEL_SANDBOX_WORKSPACE_ROOT,
-  UV_SETUP_COMMANDS as VERCEL_UV_SETUP_COMMANDS,
   WORKER_INTERNAL_TOKEN_HEADER,
   WORKER_REQUEST_ID_HEADER,
   WORKER_WORKSPACE_ID_HEADER,
   applyCspHeaders,
-  assertRealPathWithinWorkspace,
   autoDetectMode,
-  bakeSnapshotIfNeeded,
   buildDeploymentSnapshotRecipe,
-  buildPackageHash,
-  buildSnapshotRecipeHash,
   compactPiPackages,
   compileAgentDirectory,
   constantTimeTokenEqual,
   createAgent,
   createAgentApp,
-  createBwrapSandbox,
-  createDirectSandbox,
-  createLogger,
+  createAuthMiddleware as createAgentAuthMiddleware,
+  createAgentHost,
+  createAgentHostLegacyRoutePolicy,
+  createDirectModeAdapter,
+  createEnvironmentProvisioningFingerprint,
+  createFakeAuthorityVerifierV1,
+  createHostSideCredentialResolverV1,
+  createInMemoryCredentialBackendV1,
+  createLocalModeAdapter,
   createManagedAgentMcpDelegateController,
   createManagedAgentMcpHttpHandler,
   createManagedAgentMcpServer,
-  createNodeWorkspace,
+  createProviderRuntimeModeAdapter,
   createRemoteWorkerModeAdapter,
   createRemoteWorkerSandbox,
   createRemoteWorkerWorkspace,
   createResolvedAgentDigest,
+  createResolvedRuntimeScopeIdentity,
   createResourceSettingsManager,
-  createVercelDeploymentSnapshotProvider,
-  createVercelProvisioningAdapter,
-  createVercelSandboxWorkspace,
+  createSandboxRuntimeModeAdapter,
+  createValidatingAgentFleetCompiler,
+  createVercelSandboxModeAdapter,
   decodeBytesFromWorker,
   encodeBytesForWorker,
-  fileRoutes,
-  getBoringAgentPathEntries,
-  getBoringAgentRuntimeEnv,
-  getBoringAgentRuntimePaths,
   hasBwrap,
+  materializeAgentDirectory,
   mergePiPackageSources,
   normalizeMeteringUsage,
   piPackageSourceKey,
   prepareDeploymentSnapshot,
-  prepareVercelDeploymentSnapshot,
   provisionRuntimeWorkspace,
   provisionWorkspaceRuntime,
   registerAgentRoutes,
   registerShareEntryResources,
   resolveAgentDeployment,
+  resolveBuiltinRuntimeLayoutRoot,
   resolveMode,
-  resolveSandboxHandle,
   resolveWorkspaceRoot,
+  sandboxRuntimeHostOperations,
   shareResourceUri,
-  validatePath
+  withResolvedCredential
 };

package/dist/server/worker/index.d.ts

@@ -1,6 +1,8 @@
 import { FastifyInstance, FastifyRequest, FastifyReply, FastifyServerOptions } from 'fastify';
-import { B as BwrapResourceLimits, R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult } from '../../protocol-B_OQKfbI.js';
-import { a as Workspace, S as Sandbox } from '../../sandbox-DthfJaOB.js';
+import { BwrapResourceLimits } from '@hachej/boring-sandbox/providers/bwrap';
+import { SandboxProviderV1 } from '@hachej/boring-sandbox/shared';
+import { b as Workspace, S as Sandbox } from '../../sandbox-DAD8cWQR.js';
+import { R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult } from '../../middleware-CzW8n7B7.js';
 
 interface WorkerConfig {
     workspaceRoot: string;
@@ -13,7 +15,7 @@ interface WorkerConfig {
 }
 declare function loadWorkerConfig(): WorkerConfig;
 
-declare function registerWorkerRoutes(app: FastifyInstance, config: WorkerConfig): Promise<void>;
+declare function registerWorkerRoutes(app: FastifyInstance, config: WorkerConfig, runtimeProvider?: SandboxProviderV1): Promise<void>;
 
 declare const WORKER_ERROR_CODES: {
     readonly AUTH_INVALID: "auth_invalid";
@@ -28,12 +30,10 @@ type WorkerErrorCode = (typeof WORKER_ERROR_CODES)[keyof typeof WORKER_ERROR_COD
 interface WorkerRuntime {
     workspace: Workspace;
     sandbox: Sandbox;
+    dispose(): Promise<void>;
 }
 declare function assertSafeWorkspaceId(workspaceId: string): string;
-declare function createWorkerRuntime(root: string, workspaceId: string, options: {
-    bwrapNetwork: 'isolated' | 'shared';
-    resourceLimits?: BwrapResourceLimits;
-}): Promise<WorkerRuntime>;
+declare function createWorkerRuntime(root: string, workspaceId: string, provider: SandboxProviderV1): Promise<WorkerRuntime>;
 declare function runWorkspaceOp(workspace: Workspace, op: RemoteWorkerWorkspaceOp): Promise<RemoteWorkerWorkspaceResult>;
 
 declare class ExecSemaphore {
@@ -51,6 +51,8 @@ interface CreateWorkerServerOptions {
     config?: WorkerConfig;
     /** Extra Fastify server options merged over the worker defaults. */
     fastify?: FastifyServerOptions;
+    /** Host-owned worker provider (normally bwrap). */
+    runtimeProvider?: SandboxProviderV1;
 }
 interface WorkerServer {
     app: FastifyInstance;

package/dist/server/worker/index.js

@@ -1,17 +1,14 @@
 import {
-  REMOTE_WORKER_RUNTIME_CWD,
   WORKER_INTERNAL_TOKEN_HEADER,
-  constantTimeTokenEqual,
-  createBwrapSandbox,
-  createNodeWorkspace
-} from "../../chunk-I7UEASPG.js";
-import "../../chunk-XPQEF32D.js";
-import "../../chunk-M32FXCIN.js";
-import "../../chunk-WSQ5QNIY.js";
-import "../../chunk-BDYXKHWY.js";
-import "../../chunk-WZCTVT57.js";
+  constantTimeTokenEqual
+} from "../../chunk-BHH5NH7P.js";
+import "../../chunk-IWBC6SF7.js";
+import "../../chunk-CJ2BW2W2.js";
+import "../../chunk-NITBKFG6.js";
 import "../../chunk-AQBXNPMD.js";
-import "../../chunk-GOM3VJOJ.js";
+import "../../chunk-WSQ5QNIY.js";
+import "../../chunk-PZC76CIA.js";
+import "../../chunk-2GBHYJVC.js";
 
 // src/server/worker/index.ts
 import Fastify from "fastify";
@@ -132,20 +129,16 @@ function assertSafeWorkspaceId(workspaceId) {
   }
   return normalized;
 }
-async function createWorkerRuntime(root, workspaceId, options) {
+async function createWorkerRuntime(root, workspaceId, provider) {
   const safeId = assertSafeWorkspaceId(workspaceId);
   const hostRoot = join(root, safeId);
   await mkdir(hostRoot, { recursive: true });
-  const workspace = createNodeWorkspace(hostRoot, { runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD } });
-  const sandbox = createBwrapSandbox({
-    hostWorkspaceRoot: hostRoot,
-    runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
-    network: options.bwrapNetwork,
-    dropAllCapabilities: true,
-    resourceLimits: options.resourceLimits
+  const pair = await provider.create({
+    workspaceRoot: hostRoot,
+    workspaceId: safeId,
+    sessionId: safeId
   });
-  await sandbox.init?.({ workspace, sessionId: safeId });
-  return { workspace, sandbox };
+  return { workspace: pair.workspace, sandbox: pair.sandbox, dispose: () => pair.dispose() };
 }
 async function runWorkspaceOp(workspace, op) {
   switch (op.op) {
@@ -231,17 +224,15 @@ function resultToResponse(result) {
     stderrEncoding: result.stderrEncoding
   };
 }
-async function registerWorkerRoutes(app, config) {
+async function registerWorkerRoutes(app, config, runtimeProvider) {
   const semaphore = new ExecSemaphore(config.execConcurrency);
   const runtimes = /* @__PURE__ */ new Map();
   const getRuntime = (workspaceId) => {
     const safeId = assertSafeWorkspaceId(workspaceId);
     let runtime = runtimes.get(safeId);
     if (!runtime) {
-      runtime = createWorkerRuntime(config.workspaceRoot, safeId, {
-        bwrapNetwork: config.bwrapNetwork,
-        resourceLimits: config.resourceLimits
-      });
+      if (!runtimeProvider) throw new Error("worker runtime provider must be injected by the host");
+      runtime = createWorkerRuntime(config.workspaceRoot, safeId, runtimeProvider);
       runtimes.set(safeId, runtime);
     }
     return runtime;
@@ -250,7 +241,7 @@ async function registerWorkerRoutes(app, config) {
     for (const runtimePromise of runtimes.values()) {
       try {
         const runtime = await runtimePromise;
-        runtime.workspace.watch?.().close();
+        await runtime.dispose();
       } catch {
       }
     }
@@ -350,7 +341,7 @@ var DEFAULT_BODY_LIMIT = 20 * 1024 * 1024;
 async function createWorkerServer(options = {}) {
   const config = options.config ?? loadWorkerConfig();
   const app = Fastify({ logger: true, bodyLimit: DEFAULT_BODY_LIMIT, ...options.fastify });
-  await registerWorkerRoutes(app, config);
+  await registerWorkerRoutes(app, config, options.runtimeProvider);
   return { app, config };
 }
 export {